chore(deps): bump tornado from 6.5.6 to 6.5.8 in /envs/coding_env - #1114
Conversation
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.6 to 6.5.8. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.6...v6.5.8) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Native Dependabot lockfile bump of the transitive tornado package (pulled in via ipykernel → jupyter-client). Only envs/coding_env/uv.lock changes (+201/−201); no Python sources, pyproject.toml, or Dockerfile are touched.
Automated Checks
- Lint: PASS (not attributable to this PR). Lock-only diff;
uv.lock/TOML aren't linted.uvx ruff check src/ tests/→ All checks passed;ruff format --checkonly surfaces pre-existingenvs/**drift unrelated to this diff. - Debug code: CLEAN.
check-debug.shscanssrc/only; all hits are pre-existing (console.print/ doc-example prints), none introduced here. uv lock --check(coding_env): PASS — resolves cleanly (150 packages) and matchespyproject.toml.- Hashes verified against PyPI: tornado 6.5.8 sdist
9452e1b2…(520493 B) + wheels matchpypi.org;yanked: false.
Open RFCs Context
In Review: 000, 001, 002 (+Cloud-Sandbox amendment), 003, 005, 008; Draft: 010; 004 (no status header). None govern dependency management or Python package indexes, so no RFC is in scope for a lockfile bump.
Tier 1: Fixes Required
None. The lock is internally consistent, hash-pinned, and uv lock --check passes.
Tier 2: Alignment Discussion
Principle / Provenance
ALIGNMENT FLAG: Lockfile re-homed from the internal HF mirror to public PyPI (index-flip side effect)
- Principle at stake: Reproducibility (
.claude/docs/PRINCIPLES.md— "Container isolation for reproducibility") - The concern: Beyond the tornado bump, the re-lock flips all 157 package
sourceentries fromhttps://pypi.registries.huggingface.tech/→https://pypi.org/simpleand bumpsrevision2 → 3. This is metadata-only — artifact URLs stay onfiles.pythonhosted.organd every non-tornado hash is unchanged — and matches the ongoing repo-wide migration already merged for ~20 envs (e.g. #902, #921). Flagging for provenance awareness, not as a defect. Deploy impact: none —envs/coding_env/server/Dockerfileinstalls viapip install, notuv sync --frozen, so the lock (and its revision) isn't consumed at image build. - Suggested reviewer: @Darktex (reproducibility principle) / @burtenshaw (dependency tooling)
Process note (unchanged file, can't inline): .github/dependabot.yml's uv updater sets directory: "/" + exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/coding_env/... PR still edits envs/**. exclude-paths isn't honored by the uv ecosystem (the codex/dependabot-envs-* aggregate roll-ups are the intended path for env locks). FYI @burtenshaw — non-blocking.
RFC Conflicts
None identified.
Security (positive)
This is a security-positive bump — tornado 6.5.6 → 6.5.8 clears 3 advisories (6.5.8 itself has none):
- GHSA-pw6j-qg29-8w7f —
CurlAsyncHTTPClientper-request credential leak on handle reuse (fixed 6.5.7) - GHSA-wwv5-g3v4-889x —
set_cookieattribute injection via capitalized**kwargs(fixed 6.5.8) - GHSA-8423-8fgw-73vq —
parse_multipart_form_datapre-auth memory-amplification DoS (fixed 6.5.8)
tornado is transitive via the Jupyter kernel stack, so coding_env's direct exposure to these HTTP server/client paths is limited, but staying patched is good hygiene.
Summary
- 0 mechanical issues to fix
- 2 alignment/process points for awareness (index-flip provenance +
exclude-pathsmismatch) — both non-blocking and consistent with prior merged env bumps - 0 RFC conflicts
Sent by Cursor Automation: Pre-review
| version = "6.5.6" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| sdist = { url = "https://files.pythonhosted.org/packages/50/57/6d7303a77ae439d9189108f76c0c4fd89ee5e2cc8387bffb55232565c4ed/tornado-6.5.6.tar.gz", hash = "sha256:9a365179fe8ff6b8766f602c0f67c185d778193e9bdd828b19f0b6ed7764177d", size = 518139, upload-time = "2026-05-27T15:35:54.646Z" } | ||
| version = "6.5.8" |
There was a problem hiding this comment.
The actual bump. Verified against PyPI: sdist 9452e1b2… (520493 B) + wheel hashes match, yanked: false, and 6.5.8 carries no known advisories. Security-positive — supersedes 6.5.6, which is affected by GHSA-pw6j-qg29-8w7f (fixed 6.5.7), GHSA-wwv5-g3v4-889x and GHSA-8423-8fgw-73vq (both fixed 6.5.8).
There was a problem hiding this comment.
Hold exact head 3949b0a414cd93880dbc832cd4b023e18de68fef. Against current main f8433a56f2fde5a6f20765b491b8365fc123f7fa, the effective merge is not just the advertised Tornado bump: it still rewrites 201 lines of envs/coding_env/uv.lock, including the package-index migration from pypi.registries.huggingface.tech to public PyPI. That infrastructure/provenance change needs to be separated from the routine dependency update or explicitly approved and smoke-tested. The corresponding uncomplicated Tornado update has already landed for Wildfire in #1136; do not merge this coding lock migration as a routine patch.
Sent by Cursor Automation: Release
Addressed in d88d79f: removed the registry migration and lock revision change. Only Tornado 6.5.6 to 6.5.8 remains. Frozen dependency installation, lock check, and Coding reset/step smoke passed.
1 participant
Bumps tornado from 6.5.6 to 6.5.8.
Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
a55abe3Merge pull request #3704 from bdarnell/security-6.5.8fc79488docs: add additional credit to release notes7b01763Fix test_strip_headers_on_redirect's URL-embedded-credentials casesd72fff8release notes and version bump for 6.5.8b168818auth: Formally deprecated OpenIDMixinda28476web: Also check for semicolons in deprecated mixed-case cookie args8d6363ehttputil: Enforce a new limit on the number of arguments in a requestde85b3fhttputil: Apply multipart max_parts limit earlier48fc2d4Merge pull request #3633 from bdarnell/curl-reset-654ae1dddRelease notes and version bump for 6.5.7Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only patch bump with security fixes; minimal direct code impact, though new HTTP limits could affect unusual multipart or query payloads if Tornado is on the request path.
Overview
Updates
envs/coding_env/uv.lockso the resolvedtornadopackage moves from 6.5.6 to 6.5.8, including refreshed sdist/wheel URLs and hashes. No application source or dependency declaration files change in this diff—only the locked resolution for the coding environment.The upstream jump (6.5.6 → 6.5.8) includes security and HTTP-handling hardening (e.g. stricter limits on request arguments and multipart handling, cookie parsing tweaks, and related fixes noted in Tornado’s release notes). Reviewers should treat this as a dependency refresh that may affect anything in that env that indirectly uses Tornado (often via Jupyter/notebook-related stacks).
Reviewed by Cursor Bugbot for commit d88d79f. Bugbot is set up for automated code reviews on this repo. Configure here.